cobaltstrike | 87d69fecf158f4c8b29220fefb41adf5afcc6edcbc16ddc026602bf55c92bbc4[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
87d69fecf158f4c8b29220fefb41adf5afcc6edcbc16ddc026602bf55c92bbc4.zip
Size 115KB
Sample261020-r1bdpsaz21
SHA256 c7be590ce5458dc13151c5c0a1e167e76faa5a160e429bbc6b67a193b5685c5b
MD5 62acc44bed2b8a141bf7a84c55f75996
SHA1 d4e2f81f7713e0896a81a46a6a2193ab4c11445e
SHA512 2542bbb7fa6569ce6ea2f4cdcbac951bde1ce1ed5bb240055bc867ae9c55eff818946ee86456cff9a2f35d33c74c2e1a490de16f722b07a75f5ca1273dd73c3b
SSDEEP 1536:QbS4E+NkZPR946vYbl8ggNSBN13sMcaOXqgc03uwXRWHdGWftVbbVMJV39DOns00:oScNkpLzk6NSxcaPwBQddftTWVysJ
TLSH
T101B312452FC9F9321BA0B25AD312D11FED047A5F0EAFA1EA9B4C4B4ED06325F045A16B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

467582005 trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

Botnet

467582005

http://ns1.pastcloud.xyz:553/Update/8-3-0/default.jsp
http://ns2.pastcloud.xyz:553/Update/8-3-0/default.jsp

Attributes

access_type
512
beacon_type
256
host
ns1.pastcloud.xyz,ns2.pastcloud.xyz
http_header1
AAAACgAAAD1Vc2VyLUFnZW50OiBNb3ppbGxhLzQuMCAoQ29tcGF0aWJsZTsgTVNJRSA2LjA7V2luZG93cyBOVCA1LjEpAAAACgAAABtBY2NlcHQ6ICovKiwgLi4uLCAuLi4uLi4sIC4AAAAHAAAAAAAAAAsAAAAFAAAAA3RtcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAoAAAA9VXNlci1BZ2VudDogTW96aWxsYS80LjAgKENvbXBhdGlibGU7IE1TSUUgNi4wO1dpbmRvd3MgTlQgNS4xKQAAAAcAAAAAAAAAAQAAAAwvZGVmYXVsdC5qc3AAAAAMAAAABwAAAAEAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
500
port_number
553
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCPmfpTcIEyucc7KBszezHJ9MmjFgHHP1wh03yxHvwpdl0g9vPCQrgL6lnXqqJ0LKFS6QskclnWMsUE4vjQ4vjRo1OtFz0iPB4o3IPxY6WDpiNtohfq+0sNNSZ9/CWAKoKQJmkhml1beygKV6JbZGDqlTH2lhFeS7H8KqF22ZGK2wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/Update/8-3-0/Package
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUS)
watermark
467582005

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/87d69fecf158f4c8b29220fefb41adf5afcc6edcbc16ddc026602bf55c92bbc4

File Explorer

87d69fecf158f4c8b29220fefb41adf5afcc6edcbc16ddc026602bf55c92bbc4.zip

.zip 115KB
87d69fecf158f4c8b29220fefb41adf5afcc6edcbc16ddc026602bf55c92bbc4

.dll 208KB

87d69fecf158f4c8b29220fefb41adf5afcc6edcbc16ddc026602bf55c92bbc4.zip

SHA256 c7be590ce5458dc13151c5c0a1e167e76faa5a160e429bbc6b67a193b5685c5b
MD5 62acc44bed2b8a141bf7a84c55f75996
SHA1 d4e2f81f7713e0896a81a46a6a2193ab4c11445e
SHA512 2542bbb7fa6569ce6ea2f4cdcbac951bde1ce1ed5bb240055bc867ae9c55eff818946ee86456cff9a2f35d33c74c2e1a490de16f722b07a75f5ca1273dd73c3b
SSDEEP 1536:QbS4E+NkZPR946vYbl8ggNSBN13sMcaOXqgc03uwXRWHdGWftVbbVMJV39DOns00:oScNkpLzk6NSxcaPwBQddftTWVysJ
TLSH
T101B312452FC9F9321BA0B25AD312D11FED047A5F0EAFA1EA9B4C4B4ED06325F045A16B
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

87d69fecf158f4c8b29220fefb41adf5afcc6edcbc16ddc026602bf55c92bbc4

IMPHASH 7fa9c4c247b9d54feb65b7fae02f433a
SHA256 87d69fecf158f4c8b29220fefb41adf5afcc6edcbc16ddc026602bf55c92bbc4
MD5 eb9343e62038dfc85d04bf3d067a2c30
SHA1 4d32f9e9bb221c84e183eb29b91765ed37bf0ae5
SHA512 31d2d42fb5cce9fc16ad0c7ba66623f0a2a0023aa91405f5182ccaaf94064c0d6d3b4c34f0840a2284a751c59d443bf0693e6a3b4f2038f3a8211a47b31fda27
SSDEEP 3072:z+FcIvEbJvYdGVWwk4Kj6olpR2B5f4dS/L4jjZUYlPQr5ODJw6E:AHEbJAZwBqplpAX/LmjzlYQDJbE
TLSH
T17E249D953281D532D05A0034664FC77E8FBDB8F01571D987BBE84AA99E712D3DB2A307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

93360

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

FindClose MoveFileA FindNextFileA VirtualProtect CreateRemoteThread VirtualAllocEx LoadLibraryA GetCurrentProcessId Thread32First Thread32Next OpenThread CreateToolhelp32Snapshot CreateThread SetThreadContext MapViewOfFile UnmapViewOfFile VirtualAlloc CreateFileMappingA VirtualFree SetLastError GetVersionExA PeekNamedPipe WaitNamedPipeA SetNamedPipeHandleState LocalAlloc LocalFree GetComputerNameA GetACP GetOEMCP DeleteProcThreadAttributeList HeapAlloc HeapFree GetProcessHeap InitializeProcThreadAttributeList SetErrorMode UpdateProcThreadAttribute ProcessIdToSessionId CopyFileA Process32First Process32Next VirtualQuery ExitProcess FindFirstFileA FileTimeToSystemTime GetFileAttributesA ExpandEnvironmentStringsA GetLogicalDrives SystemTimeToTzSpecificLocalTime GetFullPathNameA ResumeThread WriteProcessMemory VirtualProtectEx TerminateProcess CreateProcessA ReadProcessMemory GetThreadContext GetModuleHandleA CreateNamedPipeA GetProcAddress ReadFile GetCurrentThread ConnectNamedPipe GetCurrentProcess CloseHandle GetFileTime GetCurrentDirectoryA CreatePipe GetLocalTime GetCurrentDirectoryW GetLastError GetStartupInfoA SetCurrentDirectoryA FlushFileBuffers DisconnectNamedPipe DebugBreak RaiseException SetEnvironmentVariableW MultiByteToWideChar OpenProcess WriteFile SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA HeapSize IsValidCodePage GetCPInfo GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW SetFileTime GetTickCount WaitForSingleObject CreateFileA Sleep DuplicateHandle GetEnvironmentStrings FreeEnvironmentStringsA SetFilePointer GetFileType GetModuleHandleW DeleteFileA CreateDirectoryA RemoveDirectoryA GetCurrentThreadId GetCommandLineA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement FreeLibrary InitializeCriticalSectionAndSpinCount RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode SetHandleCount GetModuleFileNameW

advapi32

OpenProcessToken CreateProcessWithLogonW DeleteService CreateServiceA StartServiceA CryptReleaseContext CryptAcquireContextA CryptGenRandom LogonUserA CheckTokenMembership FreeSid RevertToSelf AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidA GetTokenInformation RegCloseKey RegEnumKeyA RegEnumValueA RegOpenCurrentUser RegOpenKeyExA GetUserNameA CreateProcessWithTokenW CreateProcessAsUserA AdjustTokenPrivileges ControlService QueryServiceStatusEx ImpersonateNamedPipeClient ImpersonateLoggedOnUser LookupPrivilegeValueA OpenThreadToken OpenServiceA OpenSCManagerA QueryServiceStatus CloseServiceHandle

wininet

HttpQueryInfoA InternetQueryDataAvailable InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA InternetConnectA

ws2_32

htons socket closesocket gethostname connect WSAStartup WSACleanup gethostbyname htonl ntohl ntohs recv shutdown WSAGetLastError ioctlsocket accept listen __WSAFDIsSet bind inet_ntoa select send

dnsapi

DnsFree DnsQuery_A

iphlpapi

GetIpAddrTable GetIfEntry

secur32

LsaCallAuthenticationPackage LsaConnectUntrusted LsaLookupAuthenticationPackage